1. Fortinet Single Sign On
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On
RTOL

2. Course 301 – Secured Network Deployment and IPSec VPN
Module Objectives
By the end of this module participants will be able to:
Describe how Windows login credentials can be used to authenticate users to the FortiGate device
Configure Fortinet Single Sign On
RTOL

3. Directory Services Authentication
Course 301 – Secured Network Deployment and IPSec VPN
Directory Services Authentication
Directory
Services
Server
Windows
Active
Directory
Novell
eDirectory
Kelly Miller
$d12*h1
classroom
RTOL

4. Directory Services Authentication
Course 301 – Secured Network Deployment and IPSec VPN
Directory Services Authentication
User authenticates to Directory Services at logon
Windows Active Directory
Novell eDirectory
Authentication information is passed to the FortiGate unit
User automatically gets access to permitted resources without any further authentication operations
Uses Fortinet Single Sign On (FSSO)
Previously know as Fortinet Server Authentication Extensions (FSAE)
Directory
Services
Server
Windows
Active
Directory
Novell
eDirectory
RTOL

5. Fortinet Single Sign On
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On
Detects logon event
Records workstation name, domain and user
Resolves workstation name to IP address
Determines groups user belongs to
Sends logon information to the FortiGate unit
Creates a log entry on the FortiGate unit
FSSO
Windows
Server
Windows
Domain
Controller
Kelly Miller
$d12*h1
classroom
RTOL

6. Fortinet Single Sign On
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On
Detects logon event
Records workstation name, domain and user
Resolves workstation name to IP address
Determines groups user belongs to
Sends logon information to the FortiGate unit
Creates a log entry on the FortiGate unit
FSSO
FSSO monitors which user is logged on to which workstation and passes that information to the FortiGate unit
When the user tries to access a network resource, the FortiGate unit selects the appropriate firewall policy
User must belong to a permitted user group associated with that policy
Windows
Server
Windows
Domain
Controller
RTOL

7. Fortinet Single Sign On Components
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Components
FSSO DC
Agent
Collector
Agent
Windows
Server
Windows
Domain
Controller
RTOL

8. Fortinet Single Sign On Components
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Components
FSSO DC
Agent
Collector
Agent
Depending on the working mode chosen for monitoring user logon events, the following components may be installed:
FSSO Collector Agent
FSSO Domain Controller Agent
Two possible working modes
Domain Controller Agent mode
Polling mode
Windows
Server
Windows
Domain
Controller
RTOL

9. Fortinet Single Sign On Domain Controller Agent Mode
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Domain Controller Agent Mode
Collector
Agent
Windows
Server DC
Agent
Windows
Domain
Controller
User
Logon
Event
RTOL

10. Fortinet Single Sign On Domain Controller Agent Mode
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Domain Controller Agent Mode
In this mode, a Domain Controller Agent is installed on each domain controller to monitor user logon events
A Collector Agent installed on a Window Server receives the logon event information from the DC Agent and forwards it to the FortiGate unit
The FortiGate unit determines access based on the user’s group membership and firewall policies for the destination
Collector
Agent
Windows
Server DC
Agent
Windows
Domain
Controller
User
Logon
Event
RTOL

11. Fortinet Single Sign On Polling Mode
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Polling Mode ? ?
Collector
Agent
Windows
Server
Windows
Domain
Controller
User
Logon
Event
RTOL

12. Fortinet Single Sign On Polling Mode
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Polling Mode
Polling mode does not require a Domain Controller Agent to be installed on each domain controller
A Collector Agent installed on a Window Server will poll the domain controller for user logon information every few seconds and forwards it to the FortiGate unit
Collector
Agent
RTOL

13. Domain Controller Mode versus Polling Mode
Course 301 – Secured Network Deployment and IPSec VPN
Domain Controller Mode versus Polling Mode
Polling mode
Might not be as reliable since a poll might be missed under heavy system traffic
Only one component needs to be installed on one server
FSSO in a Novell eDirectory environment works similar to polling
The eDirectory agent polls the eDiorectory server for user logon information and forwards it to the FortiGate unit
Domain Controller mode
An agent must be installed on every domain controller in the domain
Each domain controller connection requires a guaranteed 64kpbs bandwidth to ensure proper FSSO functionality
RTOL

14. Fortinet Single Sign On Using NTLM Authentication
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Using NTLM Authentication
Collector
Agent ?
Windows
Server
User
Logon
Event
Windows
Domain
Controller
NTLM negotiation
Click here to read more about NTLM authentication using FSSO
RTOL

15. Fortinet Single Sign On Using NTLM Authentication
Course 301 – Secured Network Deployment and IPSec VPN
Fortinet Single Sign On Using NTLM Authentication
Fortinet Single Sign On can also provide NTLM authentication
The FortiGate unit will initiate an NTLM negotiation with the client browser
The FortiGate unit forwards the NTLM packets to the Collector Agent for processing
The FortiGate unit determines access based on the user’s group membership and firewall policies for the destination
Click here to read more about NTLM authentication using FSSO
RTOL

16. Course 301 – Secured Network Deployment and IPSec VPN
Labs
Lab - Directory Service Authentication
Installing FSSO on the Windows server
Configuring FSSO on the FortiGate unit
Testing FSSO authentication
Click here for step-by-step instructions on completing this lab
Click here for access the FSSO installation file
RTOL

17. Course 301 – Secured Network Deployment and IPSec VPN
Student Resources
Click here to view the list of resources used in this module
RTOL